ShinyHunters

Profile

ShinyHunters (also tracked as UNC6240) is a data-theft and extortion group whose current activity has been documented since 2025 and which, according to the FBI, has breached more than 140 organisations and collected at least $70 million in payments. Its core method is large-scale data theft: it abuses corporate SSO accounts, third-party suppliers and cloud SaaS platforms (Salesforce, Snowflake), and since 2026 has been mass-exploiting a zero-day in Oracle PeopleSoft (CVE-2026-35273), bypassing WAFs through URL encoding to drop web shells. Victims span education, technology, healthcare, agriculture, transport and logistics, finance, telecoms and government, with notable cases including the theft of 2-3 TB of data from the FBI's job application portal (FBIJobs.gov), which was also defaced, and a breach at Dutch telecoms operator Odido. A distinguishing trait is its strong public messaging: it denies that its activity amounts to extortion and framed the FBI incident as a 'marketing campaign'. Despite the September 2026 arrest in the Netherlands of an alleged 24-year-old leader, the group remains active and denied any link to that individual.

Active since: 2025

Initial access

• Exploitation of the Oracle PeopleSoft zero-day CVE-2026-35273
• WAF rule evasion via URL encoding
• Compromise of corporate SSO accounts
• Compromise of third-party suppliers and trusted vendors
• Abuse of cloud SaaS platforms (Salesforce, Snowflake)

Tools

Web shells, MeshCentral remote management agent (MeshAgent), Neo-reGeorg (tunnelling proxy), SIDEEYE, Ple64.exe

What defenders should watch

• Prioritise patching Oracle PeopleSoft against CVE-2026-35273 and review internet-facing systems for web shells or anomalous uploaded files predating the patch.
• Confirm that your WAF normalises and decodes URLs before applying rules: the group evades filters with encoding tricks, so perimeter filtering alone is insufficient.
• Monitor for unauthorised remote management agent installs (MeshCentral/MeshAgent) and Neo-reGeorg-style tunnelling traffic, both indicators of persistence and lateral movement.
• Harden corporate SSO with phishing-resistant MFA and review tokens, OAuth integrations and connected-app permissions in SaaS platforms such as Salesforce and Snowflake.
• Inventory and audit third-party access: a significant share of intrusions arrives through suppliers rather than your own perimeter.
• The September 2026 arrest of an alleged member has not stopped the group's activity; sustained monitoring is advisable.

Vulnerabilities attributed

Priority mitigations

MITRE ATT&CK mitigations that cover the most techniques used by this group.

1. User Account Management (13 techniques covered)
2. User Training (12 techniques covered)
3. Multi-factor Authentication (8 techniques covered)
4. Audit (8 techniques covered)
5. Privileged Account Management (7 techniques covered)
6. Password Policies (6 techniques covered)
7. Account Use Policies (5 techniques covered)
8. Filter Network Traffic (5 techniques covered)

MITRE ATT&CK techniques

Recent victims

Sources analysed

• ShinyHunters Defiant After FBI Calls on Members to Come Forward (SecurityWeek, 9/30/2026)
• FBI tells ShinyHunters members to turn themselves in after recent arrest (BleepingComputer, 9/29/2026)
• Dutch Police Arrest 24-Year-Old Amsterdam Man in ShinyHunters Investigation (The Hacker News, 9/29/2026)
• 28th September – Threat Intelligence Report (Check Point Research, 9/28/2026)
• Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells (The Hacker News, 9/26/2026)